The vulnerability allows a low‑privileged local user to modify a temporary file created by the CODESYS Development System during administrative installation. By changing the file that specifies which components to install, the attacker can force the deployment of arbitrary components, resulting in local privilege escalation. The underlying weakness is a wrong default permission assignment (CWE‑276).

The affected product is the CODESYS Development System from CODESYS. Version information is not specified in the advisory.

The CVSS score of 8.5 indicates a high severity, and the EPSS score of less than 1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; a user with standard privileges can exploit the insecure directory permissions to modify the temporary file, elevate privileges, and potentially gain full control over the system.